2026

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance(), s

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loa

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.

IBM Platform RTM is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which co

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to cause a denial of service

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to obtain sensitive information or c

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or pote

Caucho Resin contains a path traversal vulnerability in the documentation webapp (resin-doc) that allows remote unauthen

In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the ranap_handle_co_dt() function via a arbitrar

In osmo-bsc from 1.0.1 through 1.14.1 a heap based buffer overflow issue was found in the ipaccess_proxy_read_msg()  fun

Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQ

Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrar

An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library ma

Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the d

CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty() that fails to valida

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attacke

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-s

File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applic

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last W

PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the OpenSSL and GnuT

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Profess

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset

PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression poi

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, an aut

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authen

Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes atta

Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaus

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 conta

Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/ht

An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a

A vulnerability was identified in Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha/0.2.0/0.3.0/0.3.1/0.3.2. This aff

A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustain

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEnt

WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes

zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in p

Rsyslog is a rocket-fast system for log processing. From 7.5.4 until 8.2606.0, the optional mmpstrucdata plugin's parseS

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to Too

virtio-win provides Windows paravirtualized drivers for QEMU and KVM. From mm210 until mm320, the Viosock driver permits

uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely

SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstra

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attack

CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenti

Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden referenc

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, he